@openclaw/amazon-bedrock-provider 2026.9.8 → 2026.10.1-beta.1

package/dist/.setup/{config-compat-C0KbKqqH.mjs → config-compat-HlsW2HRS.mjs}

@@ -125,6 +125,12 @@ function createLegacyWebhookListenerDoctorContract(params) {
 	};
 	const prefix = `channels.${params.channelKey}`;
 	return {
+		historicalWebhookListener: {
+			channelId: params.channelKey,
+			port: params.defaultPort,
+			preserveAuthoredActivation: params.preserveAuthoredActivation,
+			...params.defaultHost === void 0 ? {} : { host: params.defaultHost }
+		},
 		legacyConfigRules: [{
 			path: ["channels", params.channelKey],
 			message: `${prefix} webhook listeners moved to Gateway routes. Run "openclaw doctor --fix" to preserve explicitly configured listener settings as legacyWebhook.`,

package/dist/api.js

@@ -1,3 +1,2 @@
-import { mergeImplicitBedrockProvider, resolveBedrockConfigApiKey } from "./discovery-shared.js";
 import { discoverBedrockModels, resolveImplicitBedrockProvider } from "./discovery.js";
-export { discoverBedrockModels, mergeImplicitBedrockProvider, resolveBedrockConfigApiKey, resolveImplicitBedrockProvider };
+export { discoverBedrockModels, resolveImplicitBedrockProvider };

package/dist/aws-credential-refresh.js

@@ -1,9 +1,32 @@
 //#region extensions/amazon-bedrock/aws-credential-refresh.ts
-/** Refresh Smithy shared config files when Bedrock needs default-chain credentials. */
-async function refreshAwsSharedConfigCacheForBedrock(env = process.env) {
-	if (env.AWS_BEDROCK_SKIP_AUTH === "1" || env.AWS_BEARER_TOKEN_BEDROCK || env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY) return;
-	const { loadSharedConfigFiles } = await import("@smithy/shared-ini-file-loader");
-	await loadSharedConfigFiles({ ignoreCache: true });
+/** Keep shared-file refresh on the chain that actually signs the Bedrock request. */
+function bedrockCredentialDefaultProvider(init) {
+	let provider;
+	return async (...args) => {
+		const { defaultProvider } = await import("@aws-sdk/credential-provider-node");
+		provider ??= defaultProvider({
+			...init,
+			ignoreCache: true
+		});
+		return provider(...args);
+	};
+}
+/** Preserve explicit proxy and bearer authentication ahead of the default AWS chain. */
+function resolveBedrockRuntimeAuth(bearerToken) {
+	const config = { credentialDefaultProvider: bedrockCredentialDefaultProvider };
+	if (process.env.AWS_BEDROCK_SKIP_AUTH === "1") {
+		if (process.versions?.node || process.versions?.bun) config.credentials = {
+			accessKeyId: "dummy-access-key",
+			secretAccessKey: "dummy-secret-key"
+		};
+	} else {
+		const token = bearerToken || process.env.AWS_BEARER_TOKEN_BEDROCK || void 0;
+		if (token !== void 0) {
+			config.token = { token };
+			config.authSchemePreference = ["httpBearerAuth"];
+		}
+	}
+	return config;
 }
 //#endregion
-export { refreshAwsSharedConfigCacheForBedrock };
+export { bedrockCredentialDefaultProvider, resolveBedrockRuntimeAuth };

package/dist/bedrock-options.js

@@ -26,11 +26,7 @@ function supportsBedrockClaudePromptCaching(modelId, modelName) {
 		if (typeof process !== "undefined" && process.env.AWS_BEDROCK_FORCE_CACHE === "1") return true;
 		return false;
 	}
-	if (candidates.some((s) => s.includes("-4-"))) return true;
-	if (candidates.some((candidate) => candidate.includes("claude-fable-5") || candidate.includes("claude-mythos-5") || candidate.includes("claude-opus-5") || candidate.includes("claude-sonnet-5"))) return true;
-	if (candidates.some((s) => s.includes("claude-3-7-sonnet"))) return true;
-	if (candidates.some((s) => s.includes("claude-3-5-haiku"))) return true;
-	return false;
+	return candidates.some((candidate) => candidate.includes("-4-") || /claude-(?:fable-5|mythos-5|opus-5|sonnet-5|3-7-sonnet|3-5-haiku)/.test(candidate));
 }
 //#endregion
 export { resolveBedrockCachePoint, resolveBedrockPromptCachePolicy, supportsBedrockClaudePromptCaching };

package/dist/config-compat.js

@@ -1,2 +1,2 @@
-import { t as migrateAmazonBedrockLegacyConfig } from "./.setup/config-compat-C0KbKqqH.mjs";
+import { t as migrateAmazonBedrockLegacyConfig } from "./.setup/config-compat-HlsW2HRS.mjs";
 export { migrateAmazonBedrockLegacyConfig };

package/dist/control-plane.js

@@ -1,10 +1,14 @@
+import { bedrockCredentialDefaultProvider } from "./aws-credential-refresh.js";
 import { buildTimeoutAbortSignal } from "openclaw/plugin-sdk/extension-shared";
 //#region extensions/amazon-bedrock/control-plane.ts
 const BEDROCK_CONTROL_PLANE_REQUEST_TIMEOUT_MS = 3e4;
 async function loadBedrockControlPlaneSdk() {
 	const { BedrockClient, GetInferenceProfileCommand, ListFoundationModelsCommand, ListInferenceProfilesCommand } = await import("@aws-sdk/client-bedrock");
 	return {
-		createClient: (region) => new BedrockClient(region ? { region } : {}),
+		createClient: (region) => new BedrockClient({
+			...region ? { region } : {},
+			credentialDefaultProvider: bedrockCredentialDefaultProvider
+		}),
 		createGetInferenceProfileCommand: (input) => new GetInferenceProfileCommand(input),
 		createListFoundationModelsCommand: () => new ListFoundationModelsCommand({}),
 		createListInferenceProfilesCommand: (input) => new ListInferenceProfilesCommand(input)

package/dist/discovery.js

@@ -1,10 +1,9 @@
-import { refreshAwsSharedConfigCacheForBedrock } from "./aws-credential-refresh.js";
 import { loadBedrockControlPlaneSdk, runBedrockControlPlaneRequest } from "./control-plane.js";
-import { resolveBedrockConfigApiKey } from "./discovery-shared.js";
-import { resolveBedrockNativeThinkingLevelMap } from "./thinking-policy.js";
+import { isClaude5BedrockModel, resolveBedrockNativeThinkingLevelMap } from "./thinking-policy.js";
+import { resolveAwsSdkEnvVarName } from "openclaw/plugin-sdk/provider-auth-runtime";
 import { LiveModelCatalogHttpError } from "openclaw/plugin-sdk/provider-catalog-live-runtime";
-import { resolveClaudeFable5ModelIdentity, resolveClaudeModelIdentity, resolveClaudeMythos5ModelIdentity, resolveClaudeOpus5ModelIdentity, resolveClaudeSonnet5ModelIdentity, supportsClaudeAdaptiveThinking } from "openclaw/plugin-sdk/provider-model-shared";
-import { asOptionalRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { resolveClaudeModelIdentity, supportsClaudeAdaptiveThinking } from "openclaw/plugin-sdk/provider-model-shared";
+import { asOptionalRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalLowercaseString, normalizeOptionalString, normalizeSortedUniqueTrimmedStringList } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { isFutureDateTimestampMs, resolveExpiresAtMsFromDurationSeconds } from "openclaw/plugin-sdk/number-runtime";
 //#region extensions/amazon-bedrock/discovery.ts
 const DEFAULT_REFRESH_INTERVAL_SECONDS = 3600;
@@ -27,12 +26,7 @@ const DEFAULT_MAX_TOKENS = 4096;
 *          https://platform.claude.com/docs/en/about-claude/models
 */
 const KNOWN_CONTEXT_WINDOWS = {
-	"anthropic.claude-fable-5": 1e6,
-	"anthropic.claude-mythos-5": 1e6,
-	"anthropic.claude-sonnet-5": 1e6,
-	"anthropic.claude-opus-5": 1e6,
 	"anthropic.claude-3-7-sonnet-20250219-v1:0": 2e5,
-	"anthropic.claude-opus-4-8": 1e6,
 	"anthropic.claude-opus-4-7": 1e6,
 	"anthropic.claude-opus-4-6-v1": 1e6,
 	"anthropic.claude-sonnet-4-6": 1e6,
@@ -92,7 +86,7 @@ const KNOWN_CONTEXT_WINDOWS = {
 function resolveKnownContextWindow(modelId) {
 	const candidates = [modelId, modelId.replace(/^(?:us|eu|ap|apac|au|jp|global)\./, "")];
 	for (const candidate of candidates) {
-		if (resolveClaudeFable5ModelIdentity({ id: candidate }) || resolveClaudeMythos5ModelIdentity({ id: candidate }) || resolveClaudeSonnet5ModelIdentity({ id: candidate }) || resolveClaudeOpus5ModelIdentity({ id: candidate })) return 1e6;
+		if (isClaude5BedrockModel({ id: candidate })) return 1e6;
 		if (/(?:^|[/.:])anthropic\.claude-opus-4[.-]8(?:$|[-.:/])/i.test(candidate)) return 1e6;
 		if (KNOWN_CONTEXT_WINDOWS[candidate] !== void 0) return KNOWN_CONTEXT_WINDOWS[candidate];
 		const withoutVersionSuffix = candidate.replace(/:0$/, "");
@@ -102,12 +96,6 @@ function resolveKnownContextWindow(modelId) {
 function isKnownClaudeMythosPreviewModelId(modelId) {
 	return [modelId, modelId.replace(/^(?:us|eu|ap|apac|au|jp|global)\./, "")].some((candidate) => /(?:^|[/.:])anthropic\.claude-mythos-preview(?:$|[-.:/])/i.test(candidate));
 }
-function resolveKnownMaxTokens(modelId) {
-	return resolveClaudeFable5ModelIdentity({ id: modelId }) || resolveClaudeMythos5ModelIdentity({ id: modelId }) || resolveClaudeSonnet5ModelIdentity({ id: modelId }) || resolveClaudeOpus5ModelIdentity({ id: modelId }) ? 128e3 : void 0;
-}
-function resolveKnownInput(modelId) {
-	return resolveClaudeFable5ModelIdentity({ id: modelId }) || resolveClaudeMythos5ModelIdentity({ id: modelId }) || resolveClaudeSonnet5ModelIdentity({ id: modelId }) || resolveClaudeOpus5ModelIdentity({ id: modelId }) ? ["text", "image"] : void 0;
-}
 const DEFAULT_COST = {
 	input: 0,
 	output: 0,
@@ -115,28 +103,12 @@ const DEFAULT_COST = {
 	cacheWrite: 0
 };
 const discoveryCache = /* @__PURE__ */ new Map();
-function normalizeProviderFilter(filter) {
-	if (!filter || filter.length === 0) return [];
-	const normalized = new Set(filter.map((entry) => normalizeOptionalLowercaseString(entry)).filter((entry) => Boolean(entry)));
-	return Array.from(normalized).toSorted();
-}
 function includesTextModalities(modalities) {
 	return (modalities ?? []).some((entry) => normalizeOptionalLowercaseString(entry) === "text");
 }
-function isActive(summary) {
-	const status = summary.modelLifecycle?.status;
-	return typeof status === "string" ? status.toUpperCase() === "ACTIVE" : false;
-}
 function mapInputModalities(summary) {
-	const inputs = summary.inputModalities ?? [];
-	const mapped = /* @__PURE__ */ new Set();
-	for (const modality of inputs) {
-		const lower = normalizeOptionalLowercaseString(modality);
-		if (lower === "text") mapped.add("text");
-		if (lower === "image") mapped.add("image");
-	}
-	if (mapped.size === 0) mapped.add("text");
-	return Array.from(mapped);
+	const inputs = (summary.inputModalities ?? []).map(normalizeOptionalLowercaseString).filter((modality) => modality === "text" || modality === "image");
+	return inputs.length > 0 ? [...new Set(inputs)] : ["text"];
 }
 function inferReasoningSupport(summary) {
 	if (supportsClaudeAdaptiveThinking({ id: summary.modelId })) return true;
@@ -159,13 +131,7 @@ function matchesProviderFilter(summary, filter) {
 	return filter.includes(normalized);
 }
 function shouldIncludeSummary(summary, filter) {
-	if (!summary.modelId?.trim()) return false;
-	if (!matchesProviderFilter(summary, filter)) return false;
-	if (summary.responseStreamingSupported !== true) return false;
-	if (isKnownClaudeMythosPreviewModelId(summary.modelId)) return false;
-	if (!includesTextModalities(summary.outputModalities)) return false;
-	if (!isActive(summary)) return false;
-	return true;
+	return Boolean(summary.modelId?.trim() && matchesProviderFilter(summary, filter) && summary.responseStreamingSupported === true && !isKnownClaudeMythosPreviewModelId(summary.modelId) && includesTextModalities(summary.outputModalities) && typeof summary.modelLifecycle?.status === "string" && summary.modelLifecycle.status.toUpperCase() === "ACTIVE");
 }
 function toModelDefinition(summary, defaults) {
 	const id = summary.modelId?.trim() ?? "";
@@ -177,7 +143,7 @@ function toModelDefinition(summary, defaults) {
 		input: mapInputModalities(summary),
 		cost: DEFAULT_COST,
 		contextWindow: resolveKnownContextWindow(id) ?? defaults.contextWindow,
-		maxTokens: resolveKnownMaxTokens(id) ?? defaults.maxTokens,
+		maxTokens: isClaude5BedrockModel({ id }) ? 128e3 : defaults.maxTokens,
 		...thinkingLevelMap ? { thinkingLevelMap } : {}
 	};
 }
@@ -249,15 +215,16 @@ function resolveInferenceProfiles(profiles, defaults, providerFilter, foundation
 		const baseModel = baseModelId ? foundationModels.get(normalizeLowercaseStringOrEmpty(baseModelId)) : void 0;
 		const knownThinkingLevelMap = resolveBedrockNativeThinkingLevelMap(baseModelId ?? profile.inferenceProfileId);
 		const contractModelId = baseModelId ?? profile.inferenceProfileId;
+		const claude5 = isClaude5BedrockModel({ id: contractModelId });
 		const canonicalClaudeId = resolveClaudeModelIdentity({ id: baseModelId });
 		discovered.push({
 			id: profile.inferenceProfileId,
 			name: profile.inferenceProfileName?.trim() || profile.inferenceProfileId,
 			reasoning: baseModel?.reasoning ?? supportsClaudeAdaptiveThinking({ id: baseModelId ?? profile.inferenceProfileId }),
-			input: baseModel?.input ?? resolveKnownInput(contractModelId) ?? ["text"],
+			input: baseModel?.input ?? (claude5 ? ["text", "image"] : ["text"]),
 			cost: baseModel?.cost ?? DEFAULT_COST,
-			contextWindow: baseModel?.contextWindow ?? resolveKnownContextWindow(baseModelId ?? profile.inferenceProfileId ?? "") ?? defaults.contextWindow,
-			maxTokens: baseModel?.maxTokens ?? resolveKnownMaxTokens(baseModelId ?? profile.inferenceProfileId) ?? defaults.maxTokens,
+			contextWindow: baseModel?.contextWindow ?? resolveKnownContextWindow(contractModelId) ?? defaults.contextWindow,
+			maxTokens: baseModel?.maxTokens ?? (claude5 ? 128e3 : defaults.maxTokens),
 			...baseModel?.thinkingLevelMap || knownThinkingLevelMap ? { thinkingLevelMap: baseModel?.thinkingLevelMap ?? knownThinkingLevelMap } : {},
 			...canonicalClaudeId.startsWith("claude-") ? { params: { canonicalModelId: canonicalClaudeId } } : {}
 		});
@@ -267,7 +234,7 @@ function resolveInferenceProfiles(profiles, defaults, providerFilter, foundation
 /** Public discovery is advisory by default; catalog owners opt into strict acquisition. */
 async function discoverBedrockModels(params) {
 	const refreshIntervalSeconds = Math.max(0, Math.floor(params.config?.refreshInterval ?? DEFAULT_REFRESH_INTERVAL_SECONDS));
-	const providerFilter = normalizeProviderFilter(params.config?.providerFilter);
+	const providerFilter = normalizeSortedUniqueTrimmedStringList(params.config?.providerFilter?.map(normalizeOptionalLowercaseString));
 	const defaultContextWindow = resolveDefaultContextWindow(params.config);
 	const defaultMaxTokens = resolveDefaultMaxTokens(params.config);
 	const cacheKey = JSON.stringify({
@@ -285,9 +252,7 @@ async function discoverBedrockModels(params) {
 		discoveryCache.delete(cacheKey);
 	}
 	const sdk = await loadBedrockControlPlaneSdk();
-	const clientFactory = params.clientFactory ?? ((region) => sdk.createClient(region));
-	if (!params.clientFactory) await refreshAwsSharedConfigCacheForBedrock();
-	const client = clientFactory(params.region);
+	const client = (params.clientFactory ?? ((region) => sdk.createClient(region)))(params.region);
 	const discoveryPromise = (async () => {
 		try {
 			const foundationCommand = sdk.createListFoundationModelsCommand();
@@ -356,7 +321,7 @@ async function resolveImplicitBedrockProvider(params) {
 	const env = params.env ?? process.env;
 	const discoveryConfig = params.pluginConfig?.discovery;
 	const enabled = discoveryConfig?.enabled;
-	const hasAwsCreds = resolveBedrockConfigApiKey(env) !== void 0;
+	const hasAwsCreds = resolveAwsSdkEnvVarName(env) !== void 0;
 	if (enabled === false) return null;
 	if (enabled !== true && !hasAwsCreds) return null;
 	const region = discoveryConfig?.region ?? normalizeOptionalString(env.AWS_REGION) ?? normalizeOptionalString(env.AWS_DEFAULT_REGION) ?? "us-east-1";

package/dist/embedding-provider.js

@@ -1,11 +1,7 @@
-import { refreshAwsSharedConfigCacheForBedrock } from "./aws-credential-refresh.js";
-import { debugEmbeddingsLog, sanitizeAndNormalizeEmbedding } from "openclaw/plugin-sdk/memory-core-host-engine-embeddings";
+import { bedrockCredentialDefaultProvider } from "./aws-credential-refresh.js";
 import { asOptionalRecord, normalizeLowercaseStringOrEmpty, normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { debugEmbeddingsLog, normalizeEmbeddingModelWithPrefixes, sanitizeAndNormalizeEmbedding } from "openclaw/plugin-sdk/memory-core-host-engine-embeddings";
 //#region extensions/amazon-bedrock/embedding-provider.ts
-/**
-* Amazon Bedrock embedding provider runtime. It normalizes model-specific
-* request/response shapes across Titan, Cohere, Nova, and TwelveLabs models.
-*/
 /** Default Bedrock embedding model used when no explicit model is configured. */
 const DEFAULT_BEDROCK_EMBEDDING_MODEL = "amazon.titan-embed-text-v2:0";
 const MODELS = {
@@ -117,12 +113,7 @@ async function loadSdk() {
 function loadDefaultCredentialProvider() {
 	return credentialProviderPromise ??= import("@aws-sdk/credential-provider-node").then(({ defaultProvider }) => defaultProvider).catch(() => null);
 }
-const MODEL_PREFIX_RE = /^(?:bedrock|amazon-bedrock|aws)\//;
 const REGION_RE = /bedrock-runtime(?:-fips)?\.([a-z0-9-]+)\./;
-function normalizeBedrockEmbeddingModel(model) {
-	const trimmed = model.trim();
-	return trimmed ? trimmed.replace(MODEL_PREFIX_RE, "") : DEFAULT_BEDROCK_EMBEDDING_MODEL;
-}
 function regionFromUrl(url) {
 	return url?.trim() ? REGION_RE.exec(url)?.[1] : void 0;
 }
@@ -186,7 +177,7 @@ function asNumberArray(value) {
 }
 function asNumberArrayBatch(value) {
 	if (!Array.isArray(value)) throw malformedBedrockEmbeddingResponse();
-	return value.map((entry) => asNumberArray(entry));
+	return value.map(asNumberArray);
 }
 function parseSingle(family, raw) {
 	const data = parseEmbeddingResponseJson(raw);
@@ -203,7 +194,6 @@ function parseSingle(family, raw) {
 }
 function parseCohereBatch(family, raw) {
 	const embeddings = parseEmbeddingResponseJson(raw).embeddings;
-	if (!embeddings) throw malformedBedrockEmbeddingResponse();
 	if (family === "cohere-v4" && !Array.isArray(embeddings)) {
 		const embeddingRecord = asOptionalRecord(embeddings);
 		if (!embeddingRecord) throw malformedBedrockEmbeddingResponse();
@@ -222,9 +212,17 @@ async function createBedrockEmbeddingProvider(options) {
 		dimensions: client.dimensions,
 		family
 	});
+	let credentialProvider;
+	const credentialDefaultProvider = (init) => {
+		const shared = credentialProvider ??= bedrockCredentialDefaultProvider(init);
+		return (credentialOptions) => shared({
+			...credentialOptions,
+			forceRefresh: true
+		});
+	};
 	const invoke = async (body, signal) => {
-		await refreshAwsSharedConfigCacheForBedrock();
 		const sdk = new BedrockRuntimeClient({
+			credentialDefaultProvider,
 			region: client.region,
 			endpoint: client.endpoint,
 			useFipsEndpoint: client.useFipsEndpoint,
@@ -248,7 +246,7 @@ async function createBedrockEmbeddingProvider(options) {
 	};
 	const embedCohere = async (texts, inputType, signal) => {
 		const raw = await invoke(buildCohereBody(family, texts, inputType, client.dimensions), signal);
-		return parseCohereBatch(family, raw).map((e) => sanitizeAndNormalizeEmbedding(e));
+		return parseCohereBatch(family, raw).map(sanitizeAndNormalizeEmbedding);
 	};
 	const embedQuery = async (text, signal) => {
 		if (!text.trim()) return [];
@@ -281,7 +279,15 @@ async function createBedrockEmbeddingProvider(options) {
 	};
 }
 function resolveBedrockEmbeddingClient(options, BedrockRuntimeClient) {
-	const model = normalizeBedrockEmbeddingModel(options.model);
+	const model = normalizeEmbeddingModelWithPrefixes({
+		model: options.model,
+		defaultModel: DEFAULT_BEDROCK_EMBEDDING_MODEL,
+		prefixes: [
+			"bedrock/",
+			"amazon-bedrock/",
+			"aws/"
+		]
+	});
 	const spec = resolveSpec(model);
 	const providerConfig = options.config.models?.providers?.["amazon-bedrock"];
 	let endpoint = normalizeOptionalString(options.remote?.baseUrl) ?? normalizeOptionalString(providerConfig?.baseUrl);
@@ -336,6 +342,7 @@ async function hasAwsCredentials(env = process.env, loadCredentialProvider = loa
 	if (!defaultProvider) return false;
 	try {
 		const credentials = await defaultProvider({
+			ignoreCache: true,
 			timeout: 1e3,
 			maxRetries: 0
 		})();

package/dist/register.sync.runtime.js

@@ -1,15 +1,16 @@
-import { refreshAwsSharedConfigCacheForBedrock } from "./aws-credential-refresh.js";
 import { resolveBedrockPromptCachePolicy, supportsBedrockClaudePromptCaching } from "./bedrock-options.js";
 import { loadBedrockControlPlaneSdk, runBedrockControlPlaneRequest } from "./control-plane.js";
-import { resolveBedrockConfigApiKey } from "./discovery-shared.js";
 import { bedrockMemoryEmbeddingProviderAdapter } from "./memory-embedding-adapter.js";
 import { isLatestAdaptiveBedrockModelRef, isOpus47OrNewerBedrockModelRef, resolveBedrockClaudeThinkingProfile, resolveBedrockNativeThinkingLevelMap, supportsBedrockNativeMaxEffort } from "./thinking-policy.js";
 import { streamSimpleBedrock } from "./stream.runtime.js";
+import { hasRuntimeContextMarker } from "openclaw/plugin-sdk/llm";
 import { resolvePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
+import { resolveAwsSdkEnvVarName } from "openclaw/plugin-sdk/provider-auth-runtime";
 import { runLiveProviderCatalog } from "openclaw/plugin-sdk/provider-catalog-live-runtime";
 import { buildProviderReplayFamilyHooks, normalizeProviderId, resolveClaudeFable5ModelIdentity, resolveClaudeModelIdentity, resolveClaudeMythos5ModelIdentity, resolveClaudeOpus5ModelIdentity, resolveClaudeSonnet5ModelIdentity } from "openclaw/plugin-sdk/provider-model-shared";
 import { createPayloadPatchStreamWrapper } from "openclaw/plugin-sdk/provider-stream-shared";
 import { splitSystemPromptCacheBoundary } from "openclaw/plugin-sdk/provider-transport-runtime";
+import { asOptionalRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
 //#region extensions/amazon-bedrock/register.sync.runtime.ts
 function normalizeBedrockResolvedModel({ modelId, model }) {
 	const thinkingLevelMap = resolveBedrockNativeThinkingLevelMap(modelId, model.params);
@@ -59,14 +60,12 @@ function createBedrockNoCacheWrapper(baseStreamFn) {
 		cacheRetention: "none"
 	});
 }
-function isBedrockServiceTier(value) {
-	return BEDROCK_SERVICE_TIER_VALUES.some((tier) => tier === value);
-}
 function resolveBedrockServiceTier(extraParams, warn) {
 	const raw = extraParams?.serviceTier ?? extraParams?.service_tier;
 	if (typeof raw !== "string") return;
 	const normalized = raw.trim().toLowerCase();
-	if (isBedrockServiceTier(normalized)) return normalized;
+	const tier = BEDROCK_SERVICE_TIER_VALUES.find((candidate) => candidate === normalized);
+	if (tier) return tier;
 	warn(`ignoring invalid Bedrock service_tier param: ${raw}`);
 }
 function createBedrockServiceTierWrapper(underlying, serviceTier) {
@@ -140,38 +139,31 @@ async function resolveAppProfileTraits(modelId, fallbackRegion, signal) {
 function hasCachePoint(blocks) {
 	return blocks?.some((b) => b.cachePoint != null) === true;
 }
-function makeCachePoint(cacheRetention) {
-	return { cachePoint: {
-		type: "default",
-		...cacheRetention === "long" ? { ttl: "1h" } : {}
-	} };
-}
 /**
 * Inject Bedrock Converse cache points into the payload when the shared runtime skipped them
 * because it didn't recognize the model ID (application inference profiles).
 */
 function injectBedrockCachePoints(payload, cacheRetention, context, model) {
 	if (!cacheRetention || cacheRetention === "none" || resolveBedrockPromptCachePolicy(model)) return;
-	const point = makeCachePoint(cacheRetention);
+	const point = { cachePoint: {
+		type: "default",
+		...cacheRetention === "long" ? { ttl: "1h" } : {}
+	} };
 	const system = payload.system;
 	if (Array.isArray(system) && system.length > 0 && !hasCachePoint(system)) {
 		const split = context.systemPrompt && splitSystemPromptCacheBoundary(context.systemPrompt);
 		if (!split || split.stablePrefix) system.splice(split ? 1 : system.length, 0, point);
 	}
-	if (context.messages.some((message) => message.role === "user" && message.runtimeContextCarrier)) return;
+	if (context.messages.some(hasRuntimeContextMarker)) return;
 	const messages = payload.messages;
-	if (Array.isArray(messages) && messages.length > 0) {
-		for (const msg of messages.toReversed()) if (msg.role === "user" && Array.isArray(msg.content)) {
-			if (!hasCachePoint(msg.content)) msg.content.push(point);
-			break;
-		}
+	if (Array.isArray(messages)) {
+		const userContent = messages.toReversed().find((msg) => msg.role === "user" && Array.isArray(msg.content))?.content;
+		if (userContent && !hasCachePoint(userContent)) userContent.push(point);
 	}
 }
 function patchMaxThinkingEffort(payload) {
-	const fieldsValue = payload.additionalModelRequestFields;
-	const fields = fieldsValue && typeof fieldsValue === "object" && !Array.isArray(fieldsValue) ? fieldsValue : {};
-	const outputConfigValue = fields.output_config;
-	const outputConfig = outputConfigValue && typeof outputConfigValue === "object" && !Array.isArray(outputConfigValue) ? outputConfigValue : {};
+	const fields = asOptionalRecord(payload.additionalModelRequestFields) ?? {};
+	const outputConfig = asOptionalRecord(fields.output_config) ?? {};
 	outputConfig.effort = "max";
 	fields.output_config = outputConfig;
 	payload.additionalModelRequestFields = fields;
@@ -213,23 +205,6 @@ function registerAmazonBedrockPlugin(api) {
 		if (!inferenceConfig || typeof inferenceConfig !== "object") return;
 		delete inferenceConfig.temperature;
 	}
-	function withAwsCredentialRefreshOnPayload(options) {
-		const originalOnPayload = options.onPayload;
-		return {
-			...options,
-			onPayload: async (payload, payloadModel) => {
-				const signal = options.signal;
-				signal?.throwIfAborted();
-				await refreshAwsSharedConfigCacheForBedrock();
-				signal?.throwIfAborted();
-				return originalOnPayload?.(payload, payloadModel);
-			}
-		};
-	}
-	function createAwsCredentialRefreshStreamWrapper(streamFn) {
-		if (!streamFn) return streamFn;
-		return (streamModel, context, options) => streamFn(streamModel, context, withAwsCredentialRefreshOnPayload(Object.assign({}, options)));
-	}
 	/** Extract the AWS region from a bedrock-runtime baseUrl. */
 	function extractRegionFromBaseUrl(baseUrl) {
 		if (!baseUrl) return;
@@ -271,7 +246,7 @@ function registerAmazonBedrockPlugin(api) {
 				}
 			})
 		},
-		resolveConfigApiKey: ({ env }) => resolveBedrockConfigApiKey(env),
+		resolveConfigApiKey: ({ env }) => resolveAwsSdkEnvVarName(env),
 		normalizeResolvedModel: normalizeBedrockResolvedModel,
 		supportsSystemPromptCacheBoundary: true,
 		createStreamFn: ({ model }) => model.api === "bedrock-converse-stream" ? bedrockStreamFn : void 0,
@@ -308,13 +283,13 @@ function registerAmazonBedrockPlugin(api) {
 			const shouldPatchMaxThinking = supportsNativeMax && thinkingLevel === "max";
 			const shouldPatchPayload = shouldOmitTemperature || shouldPatchMaxThinking;
 			const heuristicMatch = isAnthropicBedrockModel(modelId);
-			if (!region && !mayNeedCacheInjection && !shouldOmitTemperature && !shouldPatchMaxThinking) return createAwsCredentialRefreshStreamWrapper(wrapped);
+			if (!region && !mayNeedCacheInjection && !shouldOmitTemperature && !shouldPatchMaxThinking) return wrapped;
 			const underlying = wrapped ?? streamFn;
 			if (!underlying) return wrapped;
 			return (streamModel, context, options) => {
 				const merged = omitUnsupportedClaudeTemperature(modelRef, Object.assign({}, options, region ? { region } : {}));
 				const originalOnPayload = merged.onPayload;
-				if (!mayNeedCacheInjection) return underlying(streamModel, context, withAwsCredentialRefreshOnPayload({
+				if (!mayNeedCacheInjection) return underlying(streamModel, context, {
 					...merged,
 					...shouldPatchPayload ? { onPayload: (payload, payloadModel) => {
 						if (payload && typeof payload === "object") {
@@ -324,9 +299,9 @@ function registerAmazonBedrockPlugin(api) {
 						}
 						return originalOnPayload?.(payload, payloadModel);
 					} } : {}
-				}));
+				});
 				const cacheRetention = typeof merged.cacheRetention === "string" ? merged.cacheRetention : "short";
-				return underlying(streamModel, context, withAwsCredentialRefreshOnPayload({
+				return underlying(streamModel, context, {
 					...merged,
 					onPayload: async (payload, payloadModel) => {
 						const traits = heuristicMatch ? void 0 : await resolveAppProfileTraits(modelId, region, merged.signal);
@@ -338,7 +313,7 @@ function registerAmazonBedrockPlugin(api) {
 						}
 						return originalOnPayload?.(payload, payloadModel);
 					}
-				}));
+				});
 			};
 		},
 		matchesContextOverflowError: ({ errorMessage }) => bedrockContextOverflowPatterns.some((pattern) => pattern.test(errorMessage)),

package/dist/setup-api.js

@@ -1,6 +1,6 @@
-import { t as migrateAmazonBedrockLegacyConfig } from "./.setup/config-compat-C0KbKqqH.mjs";
-import { resolveBedrockConfigApiKey } from "./discovery-shared.js";
+import { t as migrateAmazonBedrockLegacyConfig } from "./.setup/config-compat-HlsW2HRS.mjs";
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
+import { resolveAwsSdkEnvVarName } from "openclaw/plugin-sdk/provider-auth-runtime";
 //#region extensions/amazon-bedrock/setup-api.ts
 /**
 * Lightweight Amazon Bedrock setup entry. It exposes auth detection and config
@@ -15,7 +15,7 @@ var setup_api_default = definePluginEntry({
 			id: "amazon-bedrock",
 			label: "Amazon Bedrock",
 			auth: [],
-			resolveConfigApiKey: ({ env }) => resolveBedrockConfigApiKey(env)
+			resolveConfigApiKey: ({ env }) => resolveAwsSdkEnvVarName(env)
 		});
 		api.registerConfigMigration((config) => migrateAmazonBedrockLegacyConfig(config));
 	}